Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\decrypt-files.txt
- %APPDATA%\microsoft\word\startup\decrypt-files.txt
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\0x29a.db
- D:\decrypt-files.txt
- D:\$recycle.bin\decrypt-files.txt
- D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- C:\decrypt-files.txt
- C:\$recycle.bin\decrypt-files.txt
- C:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- C:\documents and settings\decrypt-files.txt
- C:\kms\decrypt-files.txt
- C:\msocache\decrypt-files.txt
- C:\perflogs\decrypt-files.txt
- <Текущая директория>\decrypt-files.txt
- C:\recovery\decrypt-files.txt
- C:\recovery\windowsre\decrypt-files.txt
- C:\users\default\decrypt-files.txt
- C:\users\default\appdata\decrypt-files.txt
- C:\users\default\appdata\roaming\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\cloudstore\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\recent\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\system tools\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\templates\decrypt-files.txt
- C:\users\default\cookies\decrypt-files.txt
- C:\users\default\desktop\decrypt-files.txt
- C:\users\default\documents\decrypt-files.txt
- C:\users\default\documents\my music\decrypt-files.txt
- C:\users\default\documents\my pictures\decrypt-files.txt
- C:\users\default\documents\my videos\decrypt-files.txt
- C:\users\default\downloads\decrypt-files.txt
- C:\users\default\favorites\decrypt-files.txt
- C:\users\default\links\decrypt-files.txt
- C:\users\default\saved games\decrypt-files.txt
- C:\users\public\decrypt-files.txt
- C:\users\public\accountpictures\decrypt-files.txt
- C:\users\public\desktop\decrypt-files.txt
- C:\users\public\documents\decrypt-files.txt
- C:\users\public\documents\my music\decrypt-files.txt
- C:\users\public\documents\my pictures\decrypt-files.txt
- C:\users\public\documents\my videos\decrypt-files.txt
- C:\users\public\downloads\decrypt-files.txt
- C:\users\public\libraries\decrypt-files.txt
- %HOMEPATH%\decrypt-files.txt
- %HOMEPATH%\.oracle_jre_usage\decrypt-files.txt
- %HOMEPATH%\3d objects\decrypt-files.txt
- %HOMEPATH%\appdata\decrypt-files.txt
- %APPDATA%\decrypt-files.txt
- %APPDATA%\adobe\decrypt-files.txt
- %APPDATA%\adobe\flash player\decrypt-files.txt
- %APPDATA%\adobe\flash player\nativecache\decrypt-files.txt
- %APPDATA%\microsoft\decrypt-files.txt
- %APPDATA%\microsoft\addins\decrypt-files.txt
- %APPDATA%\microsoft\bibliography\decrypt-files.txt
- %APPDATA%\microsoft\bibliography\style\decrypt-files.txt
- %APPDATA%\microsoft\credentials\decrypt-files.txt
- %APPDATA%\microsoft\crypto\decrypt-files.txt
- %APPDATA%\microsoft\crypto\keys\decrypt-files.txt
- %APPDATA%\microsoft\crypto\rsa\decrypt-files.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\userdata\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\userdata\low\decrypt-files.txt
- %APPDATA%\microsoft\network\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\pbk\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\decrypt-files.txt
- %APPDATA%\microsoft\office\decrypt-files.txt
- %APPDATA%\microsoft\office\recent\decrypt-files.txt
- %APPDATA%\microsoft\proof\decrypt-files.txt
- %APPDATA%\microsoft\protect\decrypt-files.txt
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- %APPDATA%\microsoft\spelling\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\certificates\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\crls\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\ctls\decrypt-files.txt
- %APPDATA%\microsoft\templates\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\document themes\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\document themes\1033\decrypt-files.txt
- %APPDATA%\microsoft\uproof\decrypt-files.txt
- %APPDATA%\microsoft\vault\decrypt-files.txt
- %APPDATA%\microsoft\windows\decrypt-files.txt
- %APPDATA%\microsoft\windows\accountpictures\decrypt-files.txt
- %APPDATA%\microsoft\windows\cloudstore\decrypt-files.txt
- %APPDATA%\microsoft\windows\libraries\decrypt-files.txt
- %APPDATA%\microsoft\windows\network shortcuts\decrypt-files.txt
- %APPDATA%\microsoft\windows\printer shortcuts\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\automaticdestinations\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\customdestinations\decrypt-files.txt
- %APPDATA%\microsoft\windows\sendto\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessibility\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\system tools\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\windows powershell\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\winrar\decrypt-files.txt
- %APPDATA%\microsoft\windows\templates\decrypt-files.txt
- %APPDATA%\microsoft\windows\themes\decrypt-files.txt
- %APPDATA%\microsoft\windows\themes\cachedfiles\decrypt-files.txt
- %APPDATA%\microsoft\word\decrypt-files.txt
- %APPDATA%\mozilla\decrypt-files.txt
- %APPDATA%\mozilla\extensions\decrypt-files.txt
- %APPDATA%\mozilla\firefox\decrypt-files.txt
- %APPDATA%\mozilla\firefox\crash reports\decrypt-files.txt
- %APPDATA%\mozilla\firefox\crash reports\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\pending pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\deletion_request\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\pending_pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\tmp\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\minidumps\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\security_state\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\temporary\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\decrypt-files.txt
- %APPDATA%\mozilla\systemextensionsdev\decrypt-files.txt
- %APPDATA%\opera software\decrypt-files.txt
- %APPDATA%\opera software\opera stable\decrypt-files.txt
- %APPDATA%\opera software\opera stable\dictionaries\decrypt-files.txt
- %APPDATA%\opera software\opera stable\extension state\decrypt-files.txt
- %APPDATA%\opera software\opera stable\jump list icons\decrypt-files.txt
- %APPDATA%\opera software\opera stable\local storage\decrypt-files.txt
- %APPDATA%\opera software\opera stable\themes_backup\decrypt-files.txt
- %APPDATA%\opera software\opera stable\widevinecdm\decrypt-files.txt
- %APPDATA%\sun\decrypt-files.txt
- %APPDATA%\sun\java\decrypt-files.txt
- %APPDATA%\sun\java\deployment\decrypt-files.txt
- %APPDATA%\telegram desktop\decrypt-files.txt
- %APPDATA%\thunderbird\decrypt-files.txt
- %APPDATA%\thunderbird\crash reports\decrypt-files.txt
- %APPDATA%\thunderbird\crash reports\events\decrypt-files.txt
- %APPDATA%\thunderbird\pending pings\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\b376zl1q.default\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\events\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\minidumps\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\default\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\temporary\decrypt-files.txt
- %HOMEPATH%\contacts\decrypt-files.txt
- %HOMEPATH%\cookies\decrypt-files.txt
- %HOMEPATH%\desktop\decrypt-files.txt
- %HOMEPATH%\documents\decrypt-files.txt
- %HOMEPATH%\documents\my music\decrypt-files.txt
- %HOMEPATH%\documents\my pictures\decrypt-files.txt
- %HOMEPATH%\documents\my videos\decrypt-files.txt
- %HOMEPATH%\downloads\decrypt-files.txt
- %HOMEPATH%\favorites\decrypt-files.txt
- %HOMEPATH%\favorites\links\decrypt-files.txt
- %HOMEPATH%\links\decrypt-files.txt
- %HOMEPATH%\pictures\camera roll\decrypt-files.txt
- %HOMEPATH%\saved games\decrypt-files.txt
- %HOMEPATH%\searches\decrypt-files.txt
- %TEMP%\000.bmp
- %APPDATA%\microsoft\speech\files\userlexicons\sp_1ac4c8f9ddfb41f68f665e631938ae55.dat
Перемещает следующие системные файлы
- C:\recovery\windowsre\boot.sdi в C:\recovery\windowsre\boot.sdi.4e68
- C:\recovery\windowsre\reagent.xml в C:\recovery\windowsre\reagent.xml.aydfs
- C:\recovery\windowsre\winre.wim в C:\recovery\windowsre\winre.wim.ncnw
Перемещает следующие файлы
- %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl в %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl.4drvp0
- %APPDATA%\microsoft\bibliography\style\chicago.xsl в %APPDATA%\microsoft\bibliography\style\chicago.xsl.4drvp0
- %APPDATA%\microsoft\bibliography\style\gb.xsl в %APPDATA%\microsoft\bibliography\style\gb.xsl.uhaw4a
- %APPDATA%\microsoft\bibliography\style\gostname.xsl в %APPDATA%\microsoft\bibliography\style\gostname.xsl.uhaw4a
- %APPDATA%\microsoft\bibliography\style\gosttitle.xsl в %APPDATA%\microsoft\bibliography\style\gosttitle.xsl.7uj5nhu
- %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl в %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl.7uj5nhu
- %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl в %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl.o08p
- %APPDATA%\microsoft\bibliography\style\iso690.xsl в %APPDATA%\microsoft\bibliography\style\iso690.xsl.o08p
- %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl в %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl.9mrok
- %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl в %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl.9mrok
- %APPDATA%\microsoft\bibliography\style\sist02.xsl в %APPDATA%\microsoft\bibliography\style\sist02.xsl.hljbq
- %APPDATA%\microsoft\bibliography\style\turabian.xsl в %APPDATA%\microsoft\bibliography\style\turabian.xsl.hljbq
- %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400 в %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400.hljbq
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400 в %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400.2k8ex
- %APPDATA%\microsoft\office\mso1033.acl в %APPDATA%\microsoft\office\mso1033.acl.5azaf4
- %APPDATA%\microsoft\office\recent\index.dat в %APPDATA%\microsoft\office\recent\index.dat.8kvj
- %APPDATA%\microsoft\protect\credhist в %APPDATA%\microsoft\protect\credhist.az06
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a в %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a.az06
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\39cc278d-3b17-4d71-aa60-d4d7a3dee22c в %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\39cc278d-3b17-4d71-aa60-d4d7a3dee22c.az06
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred в %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred.qaybb
- %APPDATA%\microsoft\templates\normal.dotm в %APPDATA%\microsoft\templates\normal.dotm.4yrlq
- %APPDATA%\Microsoft\Templates\~$Normal.dotm в %APPDATA%\microsoft\templates\~$normal.dotm.4yrlq
- %APPDATA%\microsoft\uproof\custom.dic в %APPDATA%\microsoft\uproof\custom.dic.4yrlq
- %APPDATA%\microsoft\windows\libraries\cameraroll.library-ms в %APPDATA%\microsoft\windows\libraries\cameraroll.library-ms.zvpami
- %APPDATA%\microsoft\windows\libraries\documents.library-ms в %APPDATA%\microsoft\windows\libraries\documents.library-ms.zvpami
- %APPDATA%\microsoft\windows\libraries\music.library-ms в %APPDATA%\microsoft\windows\libraries\music.library-ms.6cjqzl6
- %APPDATA%\microsoft\windows\libraries\pictures.library-ms в %APPDATA%\microsoft\windows\libraries\pictures.library-ms.6cjqzl6
- %APPDATA%\microsoft\windows\libraries\videos.library-ms в %APPDATA%\microsoft\windows\libraries\videos.library-ms.obrhrmi
- %APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms.obrhrmi
- %APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms.obrhrmi
- %APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms.obrhrmi
- %APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms в %APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms.obrhrmi
- %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget в %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.sijb
- %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink в %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.sijb
- %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail в %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.sijb
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg в %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg.xzmorwx
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper в %APPDATA%\microsoft\windows\themes\transcodedwallpaper.xzmorwx
- %APPDATA%\Microsoft\Word\~WRA0003.wbk в %APPDATA%\microsoft\word\~wra0003.wbk.xzmorwx
- %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856 в %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856.7debvd1
- %APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\installs.ini.7debvd1
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json.pszruxw
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4.pszruxw
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2025-10-27_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2025-10-27_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4.pszruxw
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json.pszruxw
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini.0ym6
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json.0ym6
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4.0ym6
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4.stua
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4.stua
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4.stua
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4.stua
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin.wcsr5
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json.wcsr5
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json.wcsr5
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json.lnzlfj
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json.lnzlfj
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite.5juii2
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json.5juii2
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.5juii2
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.cis7uvh
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703.cis7uvh
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf.cis7uvh
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66.cis7uvh
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.8als1rj
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4.8als1rj
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json.8als1rj
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4.8als1rj
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4.8als1rj
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4.ao05pgv
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856.ao05pgv
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json.ao05pgv
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.ao05pgv
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2.q4yz
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2.d3vo9
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.d3vo9
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.ed3w8m
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.ed3w8m
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.ed3w8m
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.ed3w8m
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.zsyjka
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json.zsyjka
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.zsyjka
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json в %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json.zsyjka
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json в %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json.6gv6ak
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js в %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.6gv6ak
- %APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\profiles.ini.6gv6ak
- %APPDATA%\opera software\opera stable\91bb.tmp в %APPDATA%\opera software\opera stable\91bb.tmp.ct2npjp
- %APPDATA%\opera software\opera stable\bookmarks в %APPDATA%\opera software\opera stable\bookmarks.ct2npjp
- %APPDATA%\opera software\opera stable\current session в %APPDATA%\opera software\opera stable\current session.ct2npjp
- %APPDATA%\opera software\opera stable\default_partner_content.json в %APPDATA%\opera software\opera stable\default_partner_content.json.98or48s
- %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml в %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml.98or48s
- %APPDATA%\opera software\opera stable\extension state\000003.log в %APPDATA%\opera software\opera stable\extension state\000003.log.aqjllok
- %APPDATA%\opera software\opera stable\extension state\current в %APPDATA%\opera software\opera stable\extension state\current.aqjllok
- %APPDATA%\opera software\opera stable\extension state\log в %APPDATA%\opera software\opera stable\extension state\log.aqjllok
- %APPDATA%\opera software\opera stable\extension state\manifest-000001 в %APPDATA%\opera software\opera stable\extension state\manifest-000001.aqjllok
- %APPDATA%\opera software\opera stable\favicons в %APPDATA%\opera software\opera stable\favicons.aqjllok
- %APPDATA%\opera software\opera stable\history в %APPDATA%\opera software\opera stable\history.qjcs
- %APPDATA%\opera software\opera stable\history-journal в %APPDATA%\opera software\opera stable\history-journal.qjcs
- %APPDATA%\opera software\opera stable\local state в %APPDATA%\opera software\opera stable\local state.qjcs
- %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage в %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage.qjcs
- %APPDATA%\opera software\opera stable\login data в %APPDATA%\opera software\opera stable\login data.qjcs
- %APPDATA%\opera software\opera stable\network persistent state в %APPDATA%\opera software\opera stable\network persistent state.fzoqw
- %APPDATA%\opera software\opera stable\opera_autoupdate.log в %APPDATA%\opera software\opera stable\opera_autoupdate.log.fzoqw
- %APPDATA%\opera software\opera stable\preferences в %APPDATA%\opera software\opera stable\preferences.fzoqw
- %APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714 в %APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714.fzoqw
- %APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585 в %APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585.fzoqw
- %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip в %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip.ragmqz
- %APPDATA%\opera software\opera stable\transportsecurity в %APPDATA%\opera software\opera stable\transportsecurity.ragmqz
- %APPDATA%\opera software\opera stable\update_prefs.json в %APPDATA%\opera software\opera stable\update_prefs.json.ragmqz
- %APPDATA%\opera software\opera stable\visited links в %APPDATA%\opera software\opera stable\visited links.xoctxt
- %APPDATA%\opera software\opera stable\web data в %APPDATA%\opera software\opera stable\web data.sbej
- %APPDATA%\telegram desktop\unins000.dat в %APPDATA%\telegram desktop\unins000.dat.wgipc
- %APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\installtime20210406220621.wgipc
- %APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\installs.ini.ginnt
- %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json в %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json.ginnt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite.t85jrf
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json.t85jrf
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4.t85jrf
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite.xqs7bm
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini.xqs7bm
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite.8mlsku
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4.8mlsku
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4.bhnpjy6
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4.bhnpjy6
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4.bhnpjy6
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json.bhnpjy6
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json.bhnpjy6
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json.bhnpjy6
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite.0lyz
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json.0lyz
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json.0lyz
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite.ycatio
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite.ycatio
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite.cb2zqz
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite.9vopxqq
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite.nigw
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite.nigw
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.qy2j
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite.h2crs
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.ylweae
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.ylweae
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428.ylweae
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4.ylweae
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4.ylweae
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json.ylweae
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2 в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2.vsokrzm
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.9fc7b6w
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite.9fc7b6w
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json.9fc7b6w
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite.9fc7b6w
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json в %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json.mtqm
- %APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\profiles.ini.mtqm
Изменяет следующие файлы
- C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
- C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
- C:\users\default\ntuser.dat.log1
- C:\users\default\ntuser.dat.log2
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms
- C:\users\public\libraries\recordedtv.library-ms
- %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp
- %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl
- %APPDATA%\microsoft\bibliography\style\chicago.xsl
- %APPDATA%\microsoft\bibliography\style\gb.xsl
- %APPDATA%\microsoft\bibliography\style\gostname.xsl
- %APPDATA%\microsoft\bibliography\style\gosttitle.xsl
- %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl
- %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl
- %APPDATA%\microsoft\bibliography\style\iso690.xsl
- %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl
- %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl
- %APPDATA%\microsoft\bibliography\style\sist02.xsl
- %APPDATA%\microsoft\bibliography\style\turabian.xsl
- %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\office\mso1033.acl
- %APPDATA%\microsoft\office\recent\index.dat
- %APPDATA%\microsoft\protect\credhist
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\39cc278d-3b17-4d71-aa60-d4d7a3dee22c
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred
Изменяет множество файлов.
Подменяет следующие файлы
- %APPDATA%\Microsoft\Windows\Themes\CachedFiles\CachedImage_1152_864_POS2.jpg
- %APPDATA%\Microsoft\Windows\Themes\TranscodedWallpaper
- %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
Подключается к
- '91.##8.114.4':80
- '91.##8.114.4':443
- '91.##8.114.11':80
- '91.##8.114.25':80
- '91.##8.114.26':80
TCP
Запросы HTTP GET
Запросы HTTP POST
- http://91.##8.114.4/layhvfjr.cgi?qa###############
- http://91.##8.114.4/tniybhvxha.action?ig##################################
Другие
- '91.##8.114.4':443
Другое
Запускает на исполнение
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete (со скрытым окном)
